fix(deps): update dependency picomatch to v4.0.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
picomatch	4.0.5 → 4.0.7

---

Release Notes

micromatch/picomatch (picomatch)

v4.0.7

Compare Source

Fixed

• Fixed terminal globstars in parenthesized patterns (#​142, e279bd7).

v4.0.6

Compare Source

Fixed

• scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#​62, 5f5819d).
• scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#​58, f201165).

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: b358644

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@tailor-platform/sdk-codemod	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@tailor-platform/create-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/create-sdk@b358644

@tailor-platform/eslint-plugin-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/eslint-plugin-sdk@b358644

@tailor-platform/sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk@b358644

@tailor-platform/sdk-plugin-seed

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-seed@b358644

@tailor-platform/sdk-plugin-setup

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-setup@b358644

@tailor-platform/sdk-plugin-tailordb-erd

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-tailordb-erd@b358644

commit: b358644

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This is a patch update with bug fixes only, no breaking changes.

📦 Update Summary

• Library: picomatch
• Version: 4.0.5 → 4.0.7
• Change Type: Patch

📝 Release Notes

Release notes URL: https://github.com/micromatch/picomatch/blob/HEAD/CHANGELOG.md

Version 4.0.7 (2026-08-24)

• Fixed terminal globstars in parenthesized patterns (#142)

Version 4.0.6 (2026-08-24)

• scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62)
• scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58)

🔐 Security Assessment

• Risk: 🟢 Low

• Known vulnerabilities: Both the old version (4.0.5) and new version (4.0.7) are not affected by known CVEs. Two security vulnerabilities were previously disclosed for picomatch:

  • CVE-2026-33671 (CVSS 7.5 High): ReDoS vulnerability via extglob quantifiers — affects versions < 4.0.4
  • CVE-2026-33672 (CVSS 5.3 Moderate): Method injection in POSIX character classes — affects versions < 4.0.4

  Since both 4.0.5 and 4.0.7 are newer than 4.0.4, both versions already include the security fixes.

• Supply-chain notes: None. No maintainer changes, ownership transfers, or suspicious lifecycle scripts detected. The package is actively maintained by jonschlinkert under the micromatch organization with regular releases.

🚨 Breaking Changes

None. This is a patch release with bug fixes only.

✨ Main Changes

🐛 Bug Fixes

Pattern Scanning Improvements:

• The scan() function now correctly processes the full pattern when tokens are requested, instead of incorrectly merging remaining path segments into the final token
• Pattern parts are now returned complete with leading and trailing empty segments preserved
• Nested and escaped parentheses within patterns are now handled correctly

Globstar Handling:

• Fixed an issue where terminal globstars (e.g., ** at the end of a pattern) in parenthesized patterns were not matched correctly

These fixes improve the accuracy and reliability of glob pattern matching, particularly for complex patterns involving:

• Pattern tokenization and scanning
• Nested parentheses
• Escaped characters
• Terminal globstar expressions

🔍 Impact Analysis

📁 Usage Locations

picomatch is used in the following 2 files:

1. packages/sdk-codemod/src/runner.ts

   import picomatch from "picomatch";

   • Feature used: Default import and matcher creation (line 674)

   matches: picomatch(patterns, { dot: true }),

   • Impact: This creates file matchers for codemod file patterns. The bug fixes in 4.0.6 and 4.0.7 improve the correctness of pattern matching, particularly for complex glob patterns with parentheses and globstars. The changes are backward compatible and should only improve match accuracy.

2. packages/sdk-codemod/src/registry.test.ts

   import picomatch from "picomatch";

   • Feature used: Test file matcher creation (line 367)

   const matches = picomatch(renameBin?.filePatterns ?? [], { dot: true });

   • Impact: This tests file pattern matching in the codemod registry. The improved pattern scanning and globstar handling should not break existing tests, but may improve test accuracy for edge cases.

Transitive Dependencies

picomatch is also used as a transitive dependency by several other packages in the project:

• @​changesets/assemble-release-plan and @​changesets/get-dependents-graph (via their own dependency chains)
• fdir@​6.5.0 (optional peer dependency)
• knip@​6.32.2
• tinyglobby@​0.2.17
• unbuild@​3.5.1
• vite@​8.2.2
• vitest@​4.1.11

These transitive uses will also benefit from the bug fixes without requiring any code changes.

Assessment

The update is safe to merge. Both usage locations in the codebase use picomatch for basic glob pattern matching with the { dot: true } option, which is a standard use case. The bug fixes:

• Improve correctness for edge cases (nested parentheses, terminal globstars, pattern scanning)
• Are fully backward compatible
• Do not introduce any breaking changes to the API

No code changes are needed in the consuming code.

---

[github-actions]

Code Metrics Report (packages/sdk)

	main (63ea8bd)	#2190 (408fd49)	+/-
Coverage	81.5%	81.5%	0.0%
Code to Test Ratio	1:0.5	1:0.5	0.0

Details

  |                    | main (63ea8bd) | #2190 (408fd49) | +/-  |
  |--------------------|----------------|-----------------|------|
  | Coverage           |          81.5% |           81.5% | 0.0% |
  |   Files            |            502 |             502 |    0 |
  |   Lines            |          19744 |           19744 |    0 |
  |   Covered          |          16109 |           16109 |    0 |
  | Code to Test Ratio |          1:0.5 |           1:0.5 |  0.0 |
  |   Code             |         147898 |          147898 |    0 |
  |   Test             |          75858 |           75858 |    0 |

SDK Configure Bundle Size

	main (63ea8bd)	#2190 (408fd49)	+/-
configure-index-size	13.29KB	13.29KB	0KB
dependency-chunks-size	13.17KB	13.17KB	0KB
total-bundle-size	26.46KB	26.46KB	0KB

Runtime Performance

	main (63ea8bd)	#2190 (408fd49)	+/-
Generate Median	2,340ms	2,281ms	-59ms
Generate Max	2,371ms	2,328ms	-43ms
Apply Build Median	2,512ms	2,427ms	-85ms
Apply Build Max	2,576ms	2,439ms	-137ms

Type Performance (instantiations)

	main (63ea8bd)	#2190 (408fd49)	+/-
tailordb-basic	45,029	45,029	0
tailordb-optional	4,758	4,758	0
tailordb-relation	3,972	3,972	0
tailordb-validate	684	684	0
tailordb-hooks	5,823	5,823	0
tailordb-object	13,752	13,752	0
tailordb-enum	1,609	1,609	0
resolver-basic	12,120	12,120	0
resolver-nested	35,419	35,419	0
resolver-array	24,056	24,056	0
executor-schedule	4,489	4,489	0
executor-webhook	1,130	1,130	0
executor-record	4,585	4,585	0
executor-resolver	5,808	5,808	0
executor-operation-function	1,118	1,118	0
executor-operation-gql	1,126	1,126	0
executor-operation-webhook	1,137	1,137	0
executor-operation-workflow	1,931	1,931	0

---

Reported by octocov